CVE-2026-92066
Low risk· EPSS 4%Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Sandbox escape in the Profile Backup component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
Risk Assessment
A sandbox escape may allow malicious code to access system resources outside the sandbox, significantly increasing the risk of workstation compromise. Organizations running unpatched versions are especially exposed.
Recommendation
Update Firefox to version 156 and Thunderbird to version 156. If immediate update is not possible, consider restricting use of the profile backup feature.
Other vulnerabilities in Firefox
See all- CVE-2026-92061Critical
Incorrect boundary conditions in the Security: Process Sandboxing component. Fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92057Critical
Mitigation bypass vulnerability in the Enterprise Policies component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92051Critical
Spoofing issue due to invalid pointer in the Graphics component. Fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92048Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the Widget: Win32 component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92045Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the WebRTC component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92037Critical
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92036Critical
Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92035Critical
Sandbox escape vulnerability due to incorrect boundary conditions in the Graphics component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92034Critical
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92018Critical
Sandbox escape vulnerability in the DOM: Core & HTML component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Original NVD description (English source)
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.